Hacker News Reader

Just do a video call with the employee when they request e.g. MFA resets. Have a policy that enforces that. Maybe have them show an ID.

Showing ID would work, but a video call? I've worked remotely for years - why would half the people in IT know my face from some other dude?

Even if the person in the video call doesn’t have an ID, the IT support person could:

- compare the person with an ID on file

- invite the manager or a colleague of the person into the call to confirm

- ask for PII (birthdays, address) that are on file

I assume someone assuming the identity is more reluctant to show themselves on video. Furthermore being asked PII they are likely not as prepared.

I guess you could compare the face with the Identity you have on file when the employee joined.